Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
203
security advisorycriticalgolangMageia 8 MGASA-2021-0475 Critical: Golang Zip Panic Issues
The fix for CVE-2021-33196 can be bypassed by crafted inputs. As a result, the NewReader and OpenReader functions in archive/zip can still cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. (CVE-2021-39293) . MGASA-2021-0475 - Updated golang packages fix security vulnerability Publication date: 13 Oct 2021 URL: https://advisories.mageia.org/MGASA-2021-0475.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-39293, CVE-2021-38297 The fix for CVE-2021-33196 can be bypassed by crafted inputs. As a result, the NewReader and OpenReader functions in archive/zip can still cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. (CVE-2021-39293) A security issue has been found in go before version 1.17.2. When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments. (CVE-2021-38297) References: - https://bugs.mageia.org/show_bug.cgi?id=29526 - https://groups.google.com/g/golang-announce/c/dx9d7IOseHw - https://groups.google.com/g/golang-announce/c/7efr4VBoZIw - https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A - - https://security.archlinux.org/CVE-2021-38297 - https://www.cve.org/CVERecord?id=CVE-2021-39293 - https://www.cve.org/CVERecord?id=CVE-2021-38297 SRPMS: - 8/core/golang-1.17.2-1.mga8 . Addressing Golang vulnerabilities in Mageia is crucial. Ensure that all packages are updated regularly to prevent panic and fatal exceptions in ZIP file processing.. Golang Security, Mageia Package Update, Archive Handling, Panic Error. . Severity: Critical. LinuxSecurity.com Team
Oct 13, 2021
•Critical
Mageia
100
security advisorymoderatefixSUSE Linux 15-SP3: 2021:2788-1 Moderate Go1.16 Panic Error
An update that solves one vulnerability and has one errata is now available. . SUSE Security Update: Security update for go1.16 ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:2788-1 Rating: moderate References: #1182345 #1189162 Cross-References: CVE-2021-36221 Affected Products: SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.16 fixes the following issues: Update to go1.16.7: - go#47473 net/http: panic due to racy read of persistConn after handler panic (CVE-2021-36221 bsc#1189162) - go#47348 cmd/go: "go list -f '{{.Stale}}'" stack overflow with cyclic imports - go#47332 time: Timer reset broken under heavy use since go1.16 timer optimizations added - go#47289 cmd/link: build error with cgo in Windows, redefinition of go.map.zero - go#47015 cmd/go: go mod vendor: open C:\Users\LICENSE: Access is denied. - go#46928 cmd/compile: register conflict between external linker and duffzero on arm64 - go#46858 runtime: ppc64x binaries randomly segfault on linux 5.13rc6 - go#46551 cmd/go: unhelpful error message when running "go install" on a replaced-but-not-required package Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2021-2788=1 - SUSE Linux Enterprise Module for Development Tools 15-SP2: zypper in -t patchSUSE-SLE-Module-Development-Tools-15-SP2-2021-2788=1 Package List: - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.7-1.23.1 go1.16-doc-1.16.7-1.23.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.16-race-1.16.7-1.23.1 - SUSE Linux Enterprise Module for Development Tools 15-SP2 (aarch64 ppc64le s390x x86_64): go1.16-1.16.7-1.23.1 go1.16-doc-1.16.7-1.23.1 - SUSE Linux Enterprise Module for Development Tools 15-SP2 (aarch64 x86_64): go1.16-race-1.16.7-1.23.1 References: https://www.suse.com/security/cve/CVE-2021-36221.html https://bugzilla.suse.com/1182345 https://bugzilla.suse.com/1189162 . SUSE Security Patch resolves flaws in go1.16, correcting severe problems, such as crash errors and permission issues.. SUSE Linux, Security Update, Development Tools, Go1.16 Fixes. . LinuxSecurity.com Team
Aug 20, 2021
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!